nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Jasig CAS client for Jira - example of configuration

Martin Stiborsk1

Hello,

I'm working on upgrade of our Jira 4.2.2 to Jira 4.4.3. We are using CAS for single sign on over all services.

Now is there Soulwing CAS client, but as is mentioned on soulwing.org, the client is no more being developed.

So, I moved to Jasig CAS client (https://wiki.jasig.org/display/CASC/Configuring+Jira+with+JASIG+CAS+Client+for+Java+3.1).

Basically, it works. But I'd like to ask you, if someone could send me example of web.xml and seraph-config.xml files, because, for example I have wrong "logout" URL and also I'm not 100% sure about few configuration variables.

My second question is about "bypass paths". Such feature was possible with Soulwing client. It was possible to configure paths, that are not "casified", that are not handled by cas.

Is it possible also with Jasig CAS client?

Thanks a lot for help.

Accepted answers

All comments

Martin Stiborsk1

About bypass feature - it seems to be bad https://issues.jasig.org/browse/CASC-162

Ismael Guerra

Hi,

Which paths do you want to bypass exactly?

I think CasAuthenticationFilter only must handle login page requests but CasValidationFilter must handle all the requests.

My Web.xml

<filter-name>CasSingleSignOutFilter</filter-name>

<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>

</filter>

<filter-name>CasAuthenticationFilter</filter-name>

<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>

<init-param>

<param-name>casServerLoginUrl</param-name>

<param-value>https://cas.server.url/cas/login</param-value>

</init-param>

<init-param>

<param-name>serverName</param-name>

<param-value>http://jira.server.url</param-value>

</init-param>

</filter>

<filter-name>CasValidationFilter</filter-name>

<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>

<init-param>

<param-name>casServerUrlPrefix</param-name>

<param-value>https://cas.server.url/cas</param-value>

</init-param>

<init-param>

<param-name>serverName</param-name>

<param-value>http://jira.server.url</param-value>

</init-param>

<init-param>

<param-name>redirectAfterValidation</param-name>

<param-value>true</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>CasSingleSignOutFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasAuthenticationFilter</filter-name>

<url-pattern>/login.jsp</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasAuthenticationFilter</filter-name>

<url-pattern>/secure/Dashboard.jspa</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasValidationFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

My Seraph-config.xml

<param-name>login.url</param-name>

<param-value>https://cas.server.url/cas/login?service=${originalurl}</param-value>

<param-name>link.login.url</param-name>

<param-value>https://cas.server.url/cas/login?service=${originalurl}</param-value>

<param-name>logout.url</param-name>

<param-value>https://cas.server.url/cas/logout?service=${originalurl}</param-value>

Martin Stiborsk1

Here is configuration of bypass in Soulwing client: <filter>

&lt;filter&gt; 
  &lt;filter-name&gt;CAS-Simple-Bypass&lt;/filter-name&gt; 
  &lt;filter-class&gt;org.soulwing.cas.filter.SimpleBypassFilter&lt;/filter-class&gt; 
  &lt;init-param&gt; 
    &lt;param-name&gt;bypassPaths&lt;/param-name&gt; 
    &lt;param-value&gt;
	/rpc/*, /images/*, /styles/*,/sr*,/rest*, /secure/RunPortlet.jspa ,/secure/Logout!default.jspa, /secure/applet/* 
    &lt;/param-value&gt; 
  &lt;/init-param&gt; 
&lt;/filter&gt;

We need it becuase of for example SOAP API access, connection with Confluence and so on…

Ismael Guerra

What URL-pattern do you have por CasAuthenticationFilter? That configuration worked for me using the Jasig CAS Client, even SOAP API requests.

Martin Stiborsk1

Ouch, this seems to be exactly what I need. I was too much focused to "bypass" term so I was probably totally missed this one variable. Thanks for this hint, I will test it, then I will post here the result.

Thanks a lot again.

Martin Stiborsk1

But anyway, CasValidationFilter is used for what path is under CAS authentication process.

I need exclude few paths…

Maybe I'm a little bit out of mind now, so sorry for possbile misunderstanding.

Martin Stiborsk1

Now I get it (maybe ).

Although I can't make "whitelist" of not-casified paths (=bypass in soulwing client), but with Jasig I can make "blacklist" (CasAuthenticationFilter) of all casified paths and rest (/sr*,/secure/applet/*, ...) will be not under CAS...

Hopefully I'm not totally wrong

I'll test it tommorow.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cas